Artikel: "Did Boeing, aviation industry heed lessons of 2009 Air France crash?"

[Amira]

Interessanter Artikel aus dem Houston Chronicle, der eine Verbindung zwischen AF447 und den beiden MAX-Abstürzen gestellt. Link

Der Artikel ist unter dem Spoiler, einfach aufklappen.

 

 

Richard Mithoff first learned that a Boeing 737 Max 8 had crashed off the coast of Indonesia while watching the news, growing astonished and then alarmed as the reports of the Oct. 29 Lion Air accident rolled in over the next several weeks.

 

The details of the tragedy were strikingly familiar to Mithoff, a prominent Houston trial lawyer who had represented the family of an American couple killed in the 2009 crash of an Airbus A330-200 operating as Air France Flight 447. In both cases, a sensor had provided incorrect data to automated operating systems, triggering a confusing cacophony of warnings and alarms.

 

The cockpits lacked an indicator that might have helped pilots to recognize the danger of their situation and correct the problems before it was too late.

“Boeing, you could argue, had the benefit of everything that should have been learned from Air France,” Mithoff said. “Boeing has to be measured against what the world of engineering, of avionics, should have known by the time they were pushing this (Max) design.”

 

The crash of Lion Air Flight 610 and the downing less than six months later of another Boeing Max 8, Ethiopian Airlines Flight 302, have prompted questions of whether the aviation industry heeded lessons of the Air France tragedy a decade ago. The similarities of the accidents reach beyond sensors and indicators to the broader issues of modern jets’ increasing reliance on automated, interconnected systems and the training of pilots to intervene when those systems operate incorrectly or inadequately.

 

Among those raising these concerns is Capt. Sully Sullenberger, a retired airline captain who in 2009 safely guided US Airways Flight 1549 to an emergency landing in the Hudson River after a bird strike knocked out the engines. Sullenberger said in an email that the Air France crash showed how relying on automation can cause dependence on it and undermine pilots’ confidence to take control of situations when automation fails.

It also showed the need to provide pilots with a deep understanding of all important systems and how they operate in both routine and rare situations.

 

“The global aviation industry has not effectively applied what we have learned from the crash of Air France 447,” Sullenberger said. “Had they done so, the 737 Max crashes might have been avoided.”

 

Neither Airbus nor Air France would comment. Boeing, in a statement, said that safety remains its top priority, but warned against speculating about the causes of the Lion Air and Ethiopian Airlines crashes until the investigations are complete and final reports issued.

 

Failing sensors

At 7:29 p.m. Brazilian time on May 31, 2009, Air France Flight 447 departed Rio de Janeiro for Paris on what was supposed to be a 12-hour flight. But the jet crashed into the Atlantic Ocean some three hours and 45 minutes later, killing all 228 people on board.

Among the passengers were Michael and Anne Harris, who owned a home in Montgomery County but were living in Brazil for Michael Harris’ work with Devon Energy Corp., an Oklahoma oil and gas company. Mithoff and fellow attorney Warner Hocker represented their children, Hampton Harris and Andrew Musgrove, in a wrongful death suit.

The lawsuit, filed Nov. 12, 2009, in U.S. District Court in Houston, highlighted severe storms and the plane’s insufficient weather radar, failed components that measure airspeed and a lack of adequate training on how to address component defects should they occur.

The final investigation report released nearly three years later supported several of the law firm’s allegations. Flying at about 35,000 feet, the Airbus A330-200 experienced a phenomenon called high altitude ice crystals, which blocked the pitot probes that measure air speed. This led to inconsistent readings and prompted the autopilot to disconnect, according to the French Civil Aviation Safety Investigation Authority’s report.

The crew struggled to control the plane while flying at a high altitude and in turbulence. They likely did not notice the plane beginning to stall — they never formally identified it, according to the accident investigation — and ultimately crashed into the Atlantic. It was later determined the crew lacked sufficient training on responding to stall situations when manually controlling an aircraft cruising at high altitude.

 

The 737 Max accidents, almost 10 years later, also began with a sensor. The 737 Max planes received faulty data from an angle of attack sensor that measures the angle at which wind hits the plane’s wings to provide lift, according to preliminary investigation reports and Boeing statements. Too steep an angle of attack causes wind to separate from the upper surface of the wing and can cause the plane to stall.

This angle of attack sensor was connected to the Maneuvering Characteristics Augmentation System, or MCAS. This new software was designed to make the Boeing 737 Max handle like previous generations of the 737.

The MCAS software was designed to bring the nose of the plane down if the angle of attack was too steep and could cause a stall. In both the Lion Air and Ethiopian Airlines accidents, the faulty sensor made the software system believe the plane was approaching a stall situation, so MCAS repeatedly brought the nose down even as pilots tried to climb with manual controls, according preliminary finidings.

 

As in the Air France crash, the 737 Max pilots apparently did not have sufficient training, according to media reports and at least one lawsuit. They lacked training on differences between the 737 Max as compared to previous 737 aircraft, with some pilots receiving just one hour of training on an iPad or computer. The FAA grounded the Boeing 737 Max 8 and Max 9 planes on March 13.

Boeing said it’s developing an MCAS software update to help protect against erroneous angle of attack data. Boeing also said the function performed by MCAS was referenced in the 737 Max Flight Crew Operations Manual as behavior that would occur if the plane reaches a high angle of attack.

Lion Air could not be reached for comment, and Ethiopian Airlines declined to comment.

 

Angle of attack indicator

Cockpit indicators exist to display a plane’s angle of attack. These can provide useful and direct information in many flight conditions, but very few planes have them, Sullenberger said.

Maintaining the proper angle of attack is important. If a plane reaches what is known as the critical angle of attack, which can vary from plane to plane, it can stall at any airspeed, altitude or attitude (which is the orientation of the plane relative to the horizon), according to a 2014 report from NASA.

Right now, most pilots deduce the plane’s angle of attack from airspeed indications, which only provide a rough estimate and don’t work in many situations, said Shem Malmquist, a Boeing 777 captain and visiting professor at the Florida Institute of Technology. An angle of attack indicator could allow pilots to more accurately monitor the angle of attack throughout the flight, not just getting an alert once it’s approaching a dangerous level.

The display also could be used to check if other sensors are acting incorrectly. Loss of airspeed indicators, for instance, might make pilots think they’re stalling. They could cross-check the angle of attack indicator to see if that’s the case, Malmquist said.

“It is ironic that most modern aircraft measure (angle of attack) and that information is often used in many aircraft systems, but it is not displayed to pilots,” added Sullenberger. “Instead, pilots must infer (angle of attack) from other parameters, deducing it indirectly.”

In the Air France accident, several aviation experts said an angle of attack indicator could have assisted crew members who apparently didn’t recognize the plane was stalling.

The French Civil Aviation Safety Investigation Authority recommended that the European Union Aviation Safety Agency and the Federal Aviation Administration evaluate the relevance of requiring angle of attack indicators. In its letter responding to the recommendation, the FAA said an angle of attack indicator may improve flight crew awareness in some circumstances, but the indicators would also increase pilot training requirements and pilot workload.

The FAA, noting that more familiar, existing cockpit gauges provide angle of attack-based information, opted not to mandate angle of attack indicators. The European Union Aviation Safety Agency similarly opted not to require angle of attack indicators.

 

Boeing offers angle of attack indicators as an add-on for its 737 Max planes and some other models, but not as standard equipment, saying they provide “supplemental information only and have never been considered safety features on commercial jet transport airplanes.” Neither Lion Air Flight 610 nor Ethiopian Airlines Flight 302 had angle of attack indicators, according to media reports.

Sullenberger said they might have helped in these two crashes.

“I have flown military aircraft that were equipped with (angle of attack indicators) and found them to be essential,” Sullenberger said in his email. “I have long understood their value and importance and think that every airplane should be so equipped and pilots trained in their use.”

 

Bit of nuance

The presence of these indicators is perhaps a little more nuanced in the Boeing crashes as the software apparently interfered with flying, said Malmquist, who is also co-author of the book Angle of Attack: Air France 447 and the Future of Aviation Safety. He said the pilots might have been aware of the situation but unable to beat the software.

But like Sullenberger, he supports having the angle of attack display and said it might have given the 737 Max pilots more time to address the problem. He emphasized that pilot training would be essential to introducing these indicators.

 

American Airlines of Fort Worth said it has purchased the angle of attack indicators for Boeing 737 aircraft since its first plane was delivered in 1999. The carrier would not say if this indicator is present on its other aircraft, which include other Boeing models, Airbus, Bombardier CRJ and Embraer ERJ.

Southwest Airlines, headquartered in Dallas, said it worked with Boeing earlier this year to add the angle of attack indicators on its 737 Max aircraft as a “supplemental cross-check in the event there is an erroneous (angle of attack) signal present.” It had previously installed these indicators on its 737-700 and -800 aircraft prior to the Lion Air accident in October. Southwest only flies Boeing 737 aircraft.

United Airlines of Chicago said it does not have angle of attack indicators on any aircraft, Boeing or otherwise, because the planes already have “proven and safe” anti-stall indicators and its pilots are trained to use other flight data for the safe operation of aircraft. Atlanta-based Delta Air Lines declined to comment.

 

Designing plane systems

Software has increased the complexity of planes, and the traditional way of scrutinizing systems — taking a linear approach that looks at how one component affects another, or examining each component separately and then combining those analyses for an overall picture — is no longer sufficient, Malmquist said.

Manufacturers and regulators must look at the interactions among various parts. A malfunction may no longer be isolated to a single component, but rather cascade across the many interconnected systems in modern jets, Sullenberger said when he testified before Congress in June on the Boeing crashes.

 

The cascading effects, he said in a written version of his testimony, can cause “multiple cockpit alarms, cautions and warnings, which can cause distraction and increase workload, creating a situation that can quickly become ambiguous, confusing and overwhelming, making it much harder to analyze and solve the problem.”

In the 737 Max aircraft, for instance, the failure of an angle of attack sensor triggered false warnings of speed being both too slow and too fast, Sullenberger said.

Moving forward, Malmquist said aircraft designers need a new technique to identify and consider how a plane’s systems will interact before it takes flight. That way, instead of just assuming pilots can handle the unexpected, cascading effects, aircraft designers will know how the systems interact and be able to create more adequate pilot training programs.

“We must find out how design issues, training, policies, procedures, safety culture, pilot experience and other factors affected the pilots’ ability to handle these sudden emergencies, especially in this global aviation industry,” Sullenberger said in congressional testimony. “Dr. Nancy Leveson, of the Massachusetts Institute of Technology, has a quote that succinctly encapsulates much of what I have learned over many years: ‘Human error is a symptom of a system that needs to be redesigned.’”

 

Moving forward

As for Mithoff and Hocker, their Air France case was resolved, but the terms kept confidential.

Still, they insisted that Boeing and the aviation industry, overall, should have learned from investigation findings released to the public. Those lessons included creating cockpit alerts that present data in a meaningful way and providing adequate pilot training.

The latter is potentially most important. In both accidents, had pilots been made fully aware of the systems and undergone extensive simulator training for the ways those systems could malfunction, the accidents might have been prevented.

“Training goes a long way in addressing a lot of these reoccurring issues,” Hocker said.

 

[\spoiler]

[bleuair]

Zitat

The similarities of the accidents reach beyond sensors and indicators to the broader issues of modern jets’ increasing reliance on automated, interconnected systems

Joah und am Schluss ist alles darauf zurückzuführen, dass nach Adam und Eva sich die Welt immer weiter entwickelte und halt leider in Gottes Namen immer wieder etwas passierte, weil immer wieder etwas neues erfunden wurde. Sobald Menschen irgendwo involviert sind, ist die Ursache eigentlich immer klar und alle Unfälle haben eine "Similarity"!
 

Zitat

had pilots been made fully aware of the systems and undergone extensive simulator training for the ways those systems could malfunction, the accidents might have been prevented.

...aber im Ernst: Kann das Training überhaupt dem Unfall voraus sein? Gibt es überhaupt Kapazitäten, so viel zu trainieren, dass alle bisher undenkbaren Szenarien (und NUR für diese haben Piloten kein "adequate .. training" erhalten) immer abgedeckt sind? Sind Piloten überhaupt mit der Aussage einig, dass sie *noch mehr* Systeme büffeln sollten und dann alles im Sim üben bis der Arzt kommt? Vier Jahre Studium aller Systeme und Durchspielen aller möglichen Situationen, dann ein Abschluss als lic.pil. und dann, nachdem alle Trainings absolviert werden, gleich wieder von vorne, weil der Hersteller bereits wieder neue Systeme entwickelt und eingebaut hat. Von Software Releases ganz zu schweigen.

Da wünscht man sich ja gleich die Zeiten zurück, als man beim Fliegen noch den Allerwertesten gebrauchen und rausgucken musste und die Flieger nur eine Handvoll Sensoren hatten, die man aber vom PKW schon kannte. Ich glaube es ist eine falsch gerichtete Kritik, dass die Unfälle a) verwandt sind und b) mit mehr Training hätten vermieden werden können. Klar, wenn die Flieger nicht mehr abheben, weil die Piloten NUR noch trainieren, ist die Sicherheit 100%. Alles darunter wird auch in Zukunft zu Unfällen führen und dann kann ein Anwalt noch lange behaupten, dass Unfälle eh zusammenhängen und "noch mehr Training" nötig gewesen wäre und vielleicht dies oder jenes möglicherweise auch noch geholfen hätte. Der einzige Gewinner hier ist der Konjunktiv...

Hat jemand analysiert, wieviele Unfälle insgesamt passiert sind in den letzten 10 Jahren? Und wieviele auf "moderne Jets" und ihre Systeme zurückzuführen waren?

[Amira]

@bleuair Ich denke der Artikel will darauf hinaus, dass in beiden Fällen ein fehlender Sensor am Anfang stand und hätten die Piloten ein besseres Verständnis von den Systemen und den Auswirkungen von Fehlern gehabt, wären alle drei Unfälle vielleicht anders herausgekommen. In diesem Sinne stimme ich durchaus mit dem Argument überein, dass eben gewisse Lehren aus AF447 nicht gezogen wurden.

Es kann aus meiner Sicht nicht sein, dass Piloten nur noch system operators sein sollen weil die Automatik alles besser kann, aber im Falle einer Fehlfunktion dieser Automatik dann gefälligst sofort verstehen sollen was abgeht und die richtigen Schlüsse ziehen. 

[DaMane]

vor 3 Stunden schrieb Amira:

@bleuair ....................

....................

Es kann aus meiner Sicht nicht sein, dass Piloten nur noch system operators sein sollen weil die Automatik alles besser kann, aber im Falle einer Fehlfunktion dieser Automatik dann gefälligst sofort verstehen sollen was abgeht und die richtigen Schlüsse ziehen. 

 

Es freut mich, daß auch wir einmal bei einem Thema ein und derselben Meinung sind! 

 

Gruß

Manfred

[DaMane]

vor 5 Stunden schrieb bleuair:

Joah und am Schluss ist alles darauf zurückzuführen, dass nach Adam und Eva sich die Welt immer weiter entwickelte und halt leider in Gottes Namen immer wieder etwas passierte, weil immer wieder etwas neues erfunden wurde. Sobald Menschen irgendwo involviert sind, ist die Ursache eigentlich immer klar und alle Unfälle haben eine "Similarity"!
..................

 

 

Genau genommen reden wir hier nicht darüber, wie sich die Welt seit Adam und Eva immer weiterentwickelt hat, sondern wie wir unser Leben entwickelt haben. Und wenn das in eine Richtung geht, wo wir das Ergebnis teilweise nicht mehr beherrschen (können), lief (oder läuft) was in die falsche Richtung, und die Evolution wird das korrigieren. Davor wird uns keine unserer selbstgestrickten (soll heissen: menschengemachten) Technologien bewahren können.  Wir sollten auch in diesem Punkt mehr auf unsere (menschliche) Natur hören. 

 

vor 6 Stunden schrieb bleuair:

 

...aber im Ernst: Kann das Training überhaupt dem Unfall voraus sein? Gibt es überhaupt Kapazitäten, so viel zu trainieren, dass alle bisher undenkbaren Szenarien (und NUR für diese haben Piloten kein "adequate .. training" erhalten) immer abgedeckt sind? ............

Nein. Natürlich nicht. Und es wäre auch ein hoffnungsloser Ansatz. Jeder Unfall in der Luftfahrtgeschte, den auch ausreichend qualifizierte und bestens trainierte Piloten nicht verhindern konnten, war in den meisten Fällen einer erstmalige Konfrontation mit einer neuen, bis dato unbekannten Konstellation von Problemen. Gleichzeitig haben während der  inzwischen über 110 Jahre alten Geschichte des Motorfluges Menschen bewiesen, daß sie in der Lage sind, den Umgang mit Flugzeugen zu erlernen, und auf fast jedem Flug gabe ein ein mehr oder weniger kleines Problem zu lösen, um eine sichere Flugdurchführung sicherzustellen, ohne daß jemals jemand darüber geredet hätte, weil es eben zum Handwerk gehört. 

Wenn wir heute aber das Problem haben, daß "der moderne Pilot" neben seiner Hauptaufgabe, ein Flugzeug von A nach B zu fliegen, auch noch gleichmassen komplexe Techniksysteme so gut verstehen soll, daß er erfolgreich trouble-shooten kann, braucht es eine entsprechende Mensch-Maschine-Kommunikation, die spezifisch auf den Menschen zugeschintten ist (und nicht umgekehrt).

 

Gruß

Manfred 

 

[Falconer]

Naja…ja recht nett geschrieben der Artikel…aber sind mir zu viele Gemeinsamkeiten, die ich nicht unbedingt sehe, da rein vermischt…das Einzige, was man meiner Meinung nach sagen könnte, dass in solchen Fällen, und das betrifft alle neuen Cockpits, das Sammelsurium an CAS Messages und Warntönen eventuell nach wie vor suboptimal ist ,was ergonomisch korrektes Design betrifft..und relativ leicht zu einem "sensorischen Overload" ( würde ich das nennen) führen kann..und danach eben "task saturation", das Übliche halt..

 

ansonsten? Der A330 bei dem Unfall war ein völlig gesundes Flugzeug, bei dem halt die Airspeed Sensors vereist sind..was immer wieder bei verschiedensten Flugzeugmodellen in solchen Wettersituationen vorkommen kann und auch vorkommt..seit ewigen Zeiten bereits…und an sich bei richtiger Crew Action (manual Pitch & Power) einen "non event" darstellen würde..

 

Die 737 MAX hat doch ein schweres Design Defizit gehabt, das in Bodennähe gefährlich wurde…aus allen bis jetzt bekannt gewordenen Gründen..

Bearbeitet 24. August 2019 von Falconer